Referenced by 14.1.4. Measures to consider for mobile applications: avoid storing or caching data in the app and keep data in a protected, trusted area of the device; protect private cryptographic keys; implement anti-hooking and anti-tampering against runtime code injection; check application integrity (checksums, digital signatures) and obfuscate code against reverse engineering; use certificate or public key pinning against man-in-the-middle attacks; provide a secure in-app keypad against keystroke capture; and bind the device to prevent cloning of the software token.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.